Some information is lost when using CyloneDX SBOM as an intermediate in vulnerability scanning
#5424
Replies: 2 comments 1 reply
-
|
Hello @ryukez You need to update Trivy to see PkgPath: About layers - i will investigate this issue and write to you. Regards, Dmitriy |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
Thank you for quick response 😄
It'd be really appreciated, thank you!! |
Beta Was this translation helpful? Give feedback.
-
|
I created #5430 for layer issue. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Description
Hi, developers. Thank you always for developing great product!
When we use SBOM as an intermediate for vulnerability scanning, information such as PkgPath, Layer is lost in vulnerability scan report.
Here, using SBOM as an intermediate means:
trivy image python:3.9.18-slim-bullseye --format cyclonedx > sbom.json)trivy sbom sbom.json --format json > vuls.json)Desired Behavior
We expect original artifact information is saved. For example, in case of
python:3.9.18-slim-bullseye, here is the result of direct vulnerability scanning (trivy image python:3.9.18-slim-bullseye --format json > vuls.json):{ "Target": "Python", "Class": "lang-pkgs", "Type": "python-pkg", "Vulnerabilities": [ { "VulnerabilityID": "CVE-2022-40897", "PkgName": "setuptools", "PkgPath": "usr/local/lib/python3.9/site-packages/setuptools-58.1.0.dist-info/METADATA", "InstalledVersion": "58.1.0", "FixedVersion": "65.5.1", "Layer": { "Digest": "sha256:de7a1221312a618b08638bf779ae3d529927397cf96df3b1eace8cf941a66959", "DiffID": "sha256:1def056a3160854c9395aa76282dd62172ec08c18a5fa03bb7d50a777c15ba99" }, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-40897", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Title": "Regular Expression Denial of Service (ReDoS) in package_index.py", "Description": "Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.", "Severity": "HIGH", "CweIDs": [ "CWE-1333" ], "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:0952", "https://access.redhat.com/security/cve/CVE-2022-40897", "https://bugzilla.redhat.com/2158559", "https://bugzilla.redhat.com/show_bug.cgi?id=2158559", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40897", "https://errata.almalinux.org/9/ALSA-2023-0952.html", "https://errata.rockylinux.org/RLSA-2023:0952", "https://github.com/pypa/setuptools/", "https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200", "https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be", "https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1", "https://github.com/pypa/setuptools/issues/3659", "https://linux.oracle.com/cve/CVE-2022-40897.html", "https://linux.oracle.com/errata/ELSA-2023-12348.html", "https://lists.fedoraproject.org/archives/list/[email protected]/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R/", "https://lists.fedoraproject.org/archives/list/[email protected]/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H/", "https://nvd.nist.gov/vuln/detail/CVE-2022-40897", "https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/", "https://pyup.io/vulnerabilities/CVE-2022-40897/52495/", "https://security.netapp.com/advisory/ntap-20230214-0001/", "https://setuptools.pypa.io/en/latest/", "https://ubuntu.com/security/notices/USN-5817-1", "https://www.cve.org/CVERecord?id=CVE-2022-40897" ], "PublishedDate": "2022-12-23T00:15:00Z", "LastModifiedDate": "2023-08-08T14:22:00Z" } ] }Actual Behavior
Information such as PkgPath, Layer is lost. Here is the result of 2-step scan with SBOM intermediate:
{ "Target": "Python", "Class": "lang-pkgs", "Type": "python-pkg", "Vulnerabilities": [ { "VulnerabilityID": "CVE-2022-40897", "PkgName": "setuptools", "InstalledVersion": "58.1.0", "FixedVersion": "65.5.1", "Layer": {}, "SeveritySource": "ghsa", "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-40897", "Ref": "pkg:pypi/[email protected]?file_path=usr%2Flocal%2Flib%2Fpython3.9%2Fsite-packages%2Fsetuptools-58.1.0.dist-info%2FMETADATA", "DataSource": { "ID": "ghsa", "Name": "GitHub Security Advisory pip", "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "Title": "Regular Expression Denial of Service (ReDoS) in package_index.py", "Description": "Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.", "Severity": "HIGH", "CweIDs": [ "CWE-1333" ], "CVSS": { "bitnami": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "ghsa": { "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 7.5 }, "nvd": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 }, "redhat": { "V3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "V3Score": 5.9 } }, "References": [ "https://access.redhat.com/errata/RHSA-2023:0952", "https://access.redhat.com/security/cve/CVE-2022-40897", "https://bugzilla.redhat.com/2158559", "https://bugzilla.redhat.com/show_bug.cgi?id=2158559", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40897", "https://errata.almalinux.org/9/ALSA-2023-0952.html", "https://errata.rockylinux.org/RLSA-2023:0952", "https://github.com/pypa/setuptools/", "https://github.com/pypa/setuptools/blob/fe8a98e696241487ba6ac9f91faa38ade939ec5d/setuptools/package_index.py#L200", "https://github.com/pypa/setuptools/commit/43a9c9bfa6aa626ec2a22540bea28d2ca77964be", "https://github.com/pypa/setuptools/compare/v65.5.0...v65.5.1", "https://github.com/pypa/setuptools/issues/3659", "https://linux.oracle.com/cve/CVE-2022-40897.html", "https://linux.oracle.com/errata/ELSA-2023-12348.html", "https://lists.fedoraproject.org/archives/list/[email protected]/message/ADES3NLOE5QJKBLGNZNI2RGVOSQXA37R/", "https://lists.fedoraproject.org/archives/list/[email protected]/message/YNA2BAH2ACBZ4TVJZKFLCR7L23BG5C3H/", "https://nvd.nist.gov/vuln/detail/CVE-2022-40897", "https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/", "https://pyup.io/vulnerabilities/CVE-2022-40897/52495/", "https://security.netapp.com/advisory/ntap-20230214-0001/", "https://setuptools.pypa.io/en/latest/", "https://ubuntu.com/security/notices/USN-5817-1", "https://www.cve.org/CVERecord?id=CVE-2022-40897" ], "PublishedDate": "2022-12-23T00:15:00Z", "LastModifiedDate": "2023-08-08T14:22:00Z" } ] }Reproduction Steps
Target
SBOM
Scanner
Vulnerability
Output Format
CycloneDX
Mode
Standalone
Debug Output
trivy image python:3.9.18-slim-bullseye --format cyclonedx > sbom.json --debugtrivy sbom sbom.json --format json > vuls-sbom.json --debugChecklist
trivy image --resetBeta Was this translation helpful? Give feedback.
All reactions